Examkin

Question

Difficulty: MediumIdentity and Access Management Architecture

An enterprise organization is deploying a native mobile application that connects to cloud-hosted REST APIs. The mobile client runs in an untrusted environment where embedded client secrets cannot be kept confidential. Which of the following identity and access management architecture components should the security architect implement to securely authorize the mobile application while mitigating authorization code interception attacks?

  1. OAuth 2.0 Authorization Code Grant with Proof Key for Code Exchange (PKCE)Answer
  2. B
    OAuth 2.0 Implicit Grant with hardcoded API keys for client identification
  3. C
    Static API key authentication combined with internal IP address whitelisting
  4. D
    HTTP Basic Authentication wrapped inside a Role-Based Access Control (RBAC) policy

Answer

OAuth 2.0 Authorization Code Grant with Proof Key for Code Exchange (PKCE)
OAuth 2.0 Authorization Code Grant with PKCE is specifically designed to secure public clients (such as mobile apps and single-page apps) that cannot safely maintain a confidential client secret. By creating a unique code verifier and transformed code challenge for each request, the authorization server verifies that the entity redeeming the code is the exact client instance that requested it.

Step-by-Step Solution

1
Analyze client constraints
The target application is a public native mobile client, meaning embedded client secrets cannot be securely stored.
Public clients can be decompiled or inspected by attackers to extract static credentials.
2
Evaluate risk profile for authorization code flow
Standard Authorization Code Grant requires a client secret, making public clients vulnerable to code interception attacks if secrets are omitted or exposed.
Malicious applications on the mobile device can register custom URI schemes and intercept the authorization code returned by the authorization server.
3
Select appropriate IAM protocol extension
Proof Key for Code Exchange (PKCE) replaces static secrets with a dynamically generated secret key pair (code_verifier and code_challenge) per request.
This guarantees that only the application instance that initiated the request can exchange the intercepted authorization code for an access token.

Key Concept

Public Client Token Exchange and PKCE Architecture
Estimated Time:1m 30s
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic